Understand what an AI service depends on.

Look at the service in its real setting

Risk depends on what a service does, the information it handles and the people affected by it. We map the proposed use, its dependencies and the actions it can take. This helps the team focus on the issues that matter to that setting, rather than applying the same checklist to every tool.

Ask suppliers specific questions

We help turn broad concerns into questions that can be answered and evidenced. Topics can include data handling, access control, retention, service changes, support, subcontractors and exit arrangements. We record where a supplier has provided documentation, where a capability has been demonstrated and where an assurance still needs clarification.

Bring specialist review into the right decisions

Some questions need input from legal, data-protection, information-security or sector specialists. We identify those needs early and connect them to the delivery plan. For example, a charity using sensitive service information may need a different review from a business using approved public product information. The assessment should reflect that difference.

A clear record of decisions and responsibilities

You receive a structured review of the service, relevant dependencies, open questions and recommended actions. We identify owners and decision points so the findings can influence vendor selection, implementation and ongoing oversight. Any formal legal or regulatory conclusions remain with appropriately qualified advisers.

Start with a proposed service or supplier

Bring the use case, the information involved and any supplier material already available. We can support a new selection or review an existing service. We agree the scope and specialist involvement before work begins, keeping the review proportionate to the decision.